DST Password Reset

• Service tools user IDs are created through DST or SST and are separate from i5/OS^® user profiles. IBM provides the following service tools user IDs:

 

 

 

 

The passwords for service tools user IDs QSECOFR, QSRV, and 22222222 are shipped as expired. All service tools passwords are shipped in uppercase.

• You can create a maximum of 100 service tools user IDs (including the four IBM-supplied user IDs). Specific authorities are granted to the IBM-provided service tools user IDs. The IBM-supplied service tools user ID 11111111 is useful when upgrading Operations Console.

Creating additional service tools user IDs allows a security administrator to manage and audit the use of service tools without giving out the passwords to the IBM-supplied service tools user IDs. You can create additional service tools user IDs using dedicated service tools (DST) or system service tools (SST).

The passwords for service tools user IDs can have expiration dates, which allow you to minimize the security risk to your system. When users sign on with an expired password, they must change the password. A service tools user ID can be disabled, in which case it cannot be used at all until someone with the appropriate authority level re-enables it.

*IMPORTANT
If you receive the error message 'Not authorized to change IBM-supplied service tools user ID password.'  Sign off and go back to step 1 and start by signing on as QSECOFR!

Functional privileges for service tools user IDs

Functional privileges control which service functions can be accessed by any service tools user ID. You can set up functional privileges to grant or revoke the ability for a service tools user ID to access individual service functions. These examples show how you might want to use functional privileges.

• You can allow one user to take communications and Licensed Internal Code traces and give a different user the functional privilege to manage disk units.
• You can create a service tools user ID with the same functional privileges as the IBM-supplied QSECOFR service tools user ID. You can then disable the IBM-supplied QSECOFR service tools user ID. This prevents people from using the known QSECOFR user ID and helps protect your system from security risks.

You can manage the functional privileges through DST or SST. When set to revoked, the Start Service Tools privilege allows a service tools user ID to access service functions through DST, but restricts the user ID from accessing SST.

 

Before a user is allowed to use or perform a service function, a functional privilege check is performed. If a user has insufficient privileges, access to the service function is denied. There is an audit log to monitor service function use by service tools users.

*IMPORTANT
If you receive the error message 'Not authorized to change IBM-supplied service tools user ID password.'  Sign off and go back to step 1 and start by signing on as QSECOFR!